Cisco buys Astrix Security for a reported 400 million dollars
Astrix goes into Duo, Splunk, and Cisco Identity Intelligence. The pitch is extending zero-trust principles to an agentic workforce, which in practice means governing the OAuth tokens and service accounts nobody owns.
Cisco announced in early May 2026 that it intends to acquire Astrix Security, with the deal closing on 29 June. Calcalist reported the price at around 400 million dollars. Astrix was founded in 2021 by Alon Jackson and Idan Gour and had raised 45 million dollars in a Series B in late 2024. Its platform discovers and governs non-human identities: the API keys, service accounts, and OAuth tokens that applications and AI agents run on. It flags excessive privilege, manages lifecycle for agent access, and detects compromised credentials and unauthorised agent behaviour. Cisco plans to integrate it into Duo, Splunk, and Cisco Identity Intelligence.
Why it matters
The Astrix problem is unglamorous and universal. A third-party SaaS integration gets an OAuth grant during a trial, the person who approved it leaves, and two years later that token still reads the entire mail estate. Nobody owns it, no joiner-mover-leaver process touches it, and it survives every password reset and MFA rollout you run.
Cisco's angle is distribution rather than novelty. Splunk gives it the log estate, Duo gives it the enrolment footprint, and Identity Intelligence gives it a place to correlate. If your organisation already runs all three, this arrives as a feature rather than a purchase, which is exactly the pressure standalone non-human identity vendors are now under.
Astrix customers outside the Cisco estate should ask where standalone lands on the roadmap. Precedent from the acquisitions tracker is not encouraging.
Source: Cisco, price via SecurityWeek
Related on Start with Identity
- BlogSailPoint closes its Entro Security deal, reportedly at 200 million dollars
Two weeks from announcement to close. Entro brings discovery and lifecycle management for more than 1,200 kinds of secret, token, and certificate into SailPoint
- BlogCyera agrees to buy Oasis Security for about 1 billion dollars
A data-security company is paying roughly 1 billion dollars, about 700 million of it in cash, for a four-year-old non-human identity startup. The price says mor
- BlogSnowflake buys Natoma for about 110 million dollars to govern agent access to data
A two-year-old company with 27 people and a 7 million dollar seed round sold for roughly 110 million. What Snowflake bought is a verified MCP server library and
- Comparisonaembit-vs-astrix-security
Aembit brokers workload access at runtime. Astrix discovers non-human identities and scores their risk. They are complements, and only one is still sold standal
- Comparisonastrix-security-vs-entro-security
Two non-human identity discovery platforms that score identically and tie on seven of ten dimensions. Both were acquired on the same day, 29 June 2026.
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr